Reverse Engineering Stack Exchange is a question and answer site for researchers and developers who explore the principles of a system through analysis of its structure, function, and operation. It only takes a minute to sign up.
Sign up to join this community
I'm just starting out with reverse engineering, one thing I'm finding difficult is identifying different areas of memory. I'm using radare2, and I would like to be able to easily seek and identify different sections of memory (e.g. data/text/stack/heap etc):
Is there an easy way to do this within radare2?
It is possible to list the sections and segments of a program using radare2.
Sections
Use iS to list the program's Sections:
[0x00001c50]> iS
[Sections]
Nm Paddr Size Vaddr Memsz Perms Name
00 0x00000000 0 0x00000000 0 ----
01 0x00000238 28 0x00000238 28 -r-- .interp
02 0x00000254 32 0x00000254 32 -r-- .note.ABI_tag
03 0x00000274 36 0x00000274 36 -r-- .note.gnu.build_id
04 0x00000298 100 0x00000298 100 -r-- .gnu.hash
<truncated for readability>
19 0x00007bf0 8 0x00207bf0 8 -rw- .init_array
20 0x00007bf8 8 0x00207bf8 8 -rw- .fini_array
21 0x00007c00 88 0x00207c00 88 -rw- .data.rel.ro
22 0x00007c58 496 0x00207c58 496 -rw- .dynamic
23 0x00007e48 440 0x00207e48 440 -rw- .got
24 0x00008000 128 0x00208000 128 -rw- .data
25 0x00008080 0 0x00208080 416 -rw- .bss
26 0x00008080 52 0x00000000 52 ---- .gnu_debuglink
27 0x000080b4 257 0x00000000 257 ---- .shstrtab
Segements
Use iSS to list its Segments:
[0x00001c50]> iSS
[Segments]
Nm Paddr Size Vaddr Memsz Perms Name
00 0x00000040 504 0x00000040 504 -r-x PHDR
01 0x00000238 28 0x00000238 28 -r-- INTERP
02 0x00000000 28120 0x00000000 28120 -r-x LOAD0
03 0x00007bf0 1168 0x00207bf0 1584 -rw- LOAD1
04 0x00007c58 496 0x00207c58 496 -rw- DYNAMIC
05 0x00000254 68 0x00000254 68 -r-- NOTE
06 0x000060a4 580 0x000060a4 580 -r-- GNU_EH_FRAME
07 0x00000000 0 0x00000000 0 -rw- GNU_STACK
08 0x00007bf0 1040 0x00207bf0 1040 -r-- GNU_RELRO
09 0x00000000 64 0x00000000 64 -rw- ehdr
Memory maps
If you want to list different memory maps of a running executable, including the Heap and Stack, this can also be done with radare2. This is relevant only when you are debugging a program (using r2 -d <program>):
[0x7f5e8d50bca6]> dm
0x000055e186c63000 - 0x000055e186c6b000 - usr 32K s r-x /usr/bin/cat /usr/bin/cat ; map.usr_bin_cat.r_x
0x000055e186e6a000 - 0x000055e186e6b000 - usr 4K s r-- /usr/bin/cat /usr/bin/cat ; map.usr_bin_cat.rw
0x000055e186e6b000 - 0x000055e186e6c000 - usr 4K s rw- /usr/bin/cat /usr/bin/cat ; section..data
0x000055e188c8b000 - 0x000055e188cac000 - usr 132K s rw- [heap] [heap]
0x00007f5e8d446000 - 0x00007f5e8d5f9000 * usr 1.7M s r-x /usr/lib/libc-2.27.so /usr/lib/libc-2.27.so
<truncated for readability>
0x00007f5e8da28000 - 0x00007f5e8da29000 - usr 4K s rw- unk2 unk2 ; map.unk0.rw
0x00007ffffa7d7000 - 0x00007ffffa7f8000 - usr 132K s rw- [stack] [stack] ; map.stack_.rw
0x00007ffffa7f9000 - 0x00007ffffa7fc000 - usr 12K s r-- [vvar] [vvar] ; map.vvar_.r
0x00007ffffa7fc000 - 0x00007ffffa7fe000 - usr 8K s r-x [vdso] [vdso] ; map.vdso_.r_x
